XRP's Magic Money Glitch Vanishes Before Validators Could Even Vote 🪄

A decade-old integer-overflow bug in the XRP Ledger's payment engine could have allowed an attacker to mint spendable $XRP from thin air, but the flaw was patched on Sept. 25 without any new tokens entering circulation, according to a vulnerability disclosure report and statements from the XRP Ledger Foundation and RippleX. The bug, believed to date to 2015, was reported through the XRPL Bug Bounty program on Sept. 22 by researcher Cayden Liao and Veria AI. RippleX reproduced the exploit internally and said there is no evidence the vulnerability was ever used on any public network. All 100 billion $XRP were created at the ledger's launch in 2012, and its software is built so no additional tokens can ever be added.

The exploit leveraged the ledger's built-in decentralized exchange, where accounts post offers to swap one token for another. An attacker could open hundreds of accounts, have each one offer a tiny amount of a token in exchange for an unusually large amount of $XRP, and then send a single payment that bought every offer at once. The cumulative $XRP owed exceeded the 64-bit integer maximum used to track balances, causing the counter to wrap to a tiny number. The selling accounts were credited in full while the buying account was charged almost nothing, effectively printing new $XRP. A post-transaction check meant to catch new token creation relied on the same miscounted total and missed the discrepancy. A separate per-account receive limit did not trigger because the newly created $XRP was spread across hundreds of accounts. The researchers' method required only a few hundred $XRP to open the accounts, most of which could later be recovered, plus standard transaction fees.

Developers shipped the fix in xrpld version 3.4.1 on Sept. 25, three days after the bug bounty report, and the code was kept private while validators upgraded. The XRP Ledger Foundation confirmed that no new $XRP was created by the bug and that total supply remains fixed at 100 billion tokens, with the transaction fee burning mechanism having reduced circulating supply to approximately 99.986 billion $XRP. The fix marked the first deliberate bypass of the network's standard amendment process since the system was introduced more than ten years ago. Standard XRPL rule changes require backing from more than 80% of trusted validators for two weeks before taking effect, a process RippleX said would have publicly exposed the vulnerability for weeks while it remained exploitable. More than 80% of default validators upgraded on release day, before the patch's code was published, after which a normal amendment vote was completed.

"With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security," XRPL developers wrote in an X post on Sunday. The XRP Ledger Foundation said the decision to skip the standard amendment process was made jointly by the Foundation, RippleX, core developers and validators, and emphasized that no single party could make that call alone. "Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks," the foundation said. "Protocol changes still go through amendments." XRP Kuwait, an independent validator operator, also pushed back against claims that coordinated upgrades signaled centralized control, stating, "Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence."

The disclosure landed a day after Cyber Capital founder Justin Bons argued on social media that marketing $XRP to retail investors as decentralized amounted to "straight-up fraud," as the network's decentralization claims have long played a role in arguments that $XRP is not a security. The incident joins a run of long-hidden crypto vulnerabilities surfaced with AI assistance since July, including the Coldcard wallet flaw tied to the theft of at least 1,367 $BTC and the Core Lightning vulnerabilities that prompted node operators to disconnect. $XRP was trading at $1.41 at the time of the report, giving the 100 billion token cap an $88.8 billion market value.